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This is a reply to the comment 1 by Yuan et al. 
on our publication 2 -. 

We are glad that our results have led to awareness and 
discussions of imperfections in the detectors, among the 
leading research groups on avalanche-photodiode-based 
(APD-based) quantum key distribution (QKD) systems. 
Yuan et al. propose a method 1 to avoid blinding of 
gated APD-based detectors, such as the ones used in the 
two commercial QKD systems addressed in our recent 
publication 2 . Our experimental data from Clavis2 indi- 
cate that the countermeasure suggested by Yuan et al. will 
make it more difficult to blind gated detectors. 

However, for gated detectors avoiding blinding is insuffi- 
cient to avoid our attack. Gated detectors operate in linear 
mode between the gates. Therefore the trigger pulse can be 
applied right after the gate (discarding these clicks based 
on arrival times seems to be impractical due to detector 
jitter). We remarked that this causes afterpulses 2 -, but in 
fact the after-gate attack can fully compromise the security 
for a wide range of system parameters 3 -. Even outside this 
range, one must quantify in a proof of security how well 
Eve may perform. Removing the bias resistor and low- 
ering the comparator threshold does not avoid exploiting 
the linear mode between gates. In fact, lowering the com- 
parator threshold reduces the required trigger pulse power, 
and thus likely improves the after-gate attack by reducing 
aftcrpulsing. 

Furthermore, it seems that the detectors can still be 
blinded, even with the changes proposed by Yuan et al. 
Simply removing the bias resistor has turned out to be 
insufficient. In our recent paper—, we removed the bias re- 
sistor from the detectors in Clavis2. Still, we were able 
to blind the detectors in several ways. Yuan et al. did 
not observe thermal blinding from continuous-wave (c.w) 
illumination. This may be due to the lower comparator 
threshold and/or insufficient heating (they illuminate one 
instead of two APDs, while operating at a higher temper- 
ature, effectively increasing cooler capacity). 

Even if the bias resistor is removed, and the discrimina- 
tion level is set just above the capacitive charging signal 
the detectors seem to be vulnerable to sinkhole blinding^. 
In sinkhole blinding, the APD is illuminated between the 
gates. With a suitable duty cycle of the blinding illumi- 
nation, it should be straightforward to blind the detector 
while keeping the comparator input well below the ampli- 
tude of the capacitive signal. 


Monitoring photocurrent of the APDs is like using a 
power meter at Bob's entrance, which we have already 
discussed in our original paper—. Furthermore, it will not 
reveal the after-gate attack. 

It seems that the countermeasure proposed by Yuan et 
o/.— does not prevent our general attack of tailored bright 
illumination 2 .. Note that so far, we have been able to 
blind and control every APD-based detector which we have 
looked thoroughly at (although with different techniques), 
including three different passively quenched detectors^, 
one actively quenched detector—, and two different gated 
detectors^—. 

In our opinion, the discussion shows how important it 
is to close this loophole in a thorough, preferably prov- 
able way. We doubt that this could be achieved efficiently 
in small increments of intuitive patches, causing rapid it- 
erations and forcing manufacturers to update their QKD 
systems frequently. We are confident that APD-based sin- 
gle photon detectors can be, and will be made secure by 
a proper implementation combined with a sufficiently gen- 
eral security proof. 

As a final remark, we want to emphasize that in our 
experiments 2 - - — , the QKD systems were treated as black 
boxes just as they would be for Eve. We reverse-engineered 
the detector circuitries (realistically, Eve can buy a copy 
of Bob and do the same), and non- intrusively recorded the 
detector response during our experiments. Clavis2 shipped 
with factory settings ready for QKD, including the dis- 
crimination level, which we used for our experiments. As 
pointed out in our Supplementary Information 2 , QPN 5505 
did not ship with factory settings, but we followed the 
manual and used the settings which gave us the best QKD 
performance. 
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